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1 CLAIMS 

2 What is claimed is: 

1 1. An apparatus comprising: 

2 at least one network interface for coupling the apparatus to at least one network; 

3 a packet header analyzer coupled to the network interface; 

4 a detected device list coupled to the packet header analyzer; 

5 a weight definition store to store respective weight values for a plurality of packet 

6 characteristics; 

7 a weight calculator coupled to the packet header analyzer and to the weight definition store; 

8 and 

9 a packet weight history store coupled to the weight calculator. 

5 2. The apparatus of claim 1 further comprising: 

JjJ- a control interface for receiving commands. 

if 

jj| 3 . The apparatus of claim 2 further comprising: 

If the control interface being adapted to connect to a command link which is physically distinct 

l# from the at least one network. 

ru 

•j| 4. The apparatus of claim 2 wherein the control interface comprises: 

Q an SNMP interface adapted to receive SNMP commands over the least one network. 

1 5. The apparatus of claim 1 further comprising at least one of a network switch, a network hub, 

2 and a network router. 

1 6. The apparatus of claim 5 wherein the at least one network interface comprises at least two 

2 network interfaces. 

1 7. A network communication system comprising: 

2 a plurality of N network devices; 

3 a plurality of M metering devices, wherein the ratio of M:N is in the range of 1:2 to 1:512, 

4 and wherein each metering device is coupled to at least one of the network devices; and 
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5 a server coupled to the metering devices to roll up metering reports from the metering 

6 devices. 

1 8. The network communication system of claim 7 wherein the ratio of M:N is in the range of 

2 1:4 to 1:128. 

1 9. The network communication system of claim 8 wherein the ratio of M:N is in the range of 

2 1:8 to 1:32. 

1 10. The network communication system of claim 7 wherein at least two of the metering devices 

2 are coupled to respective different numbers of network devices. 

1 11. The network communication system of claim 7 wherein at least some of the metering devices 

each comprises: 

If a packet header analyzer; 

W a detected device list coupled to the packet header analyzer; and 

jg a packet weight history coupled to the detected device list. 

4 s 12. The network communication system of claim 1 1 wherein the at least some of the metering 

If devices each further comprises: 

fU 

III a weight definition store; and 

J| a weight calculator coupled to the weight definition store, the packet weight history, and the 

if packet header analyzer. 

1 13. The network communication system of claim 1 2 wherein at least some of the metering 

2 devices each comprises at least one of a network switch, a network hub, and a network router. 

1 14. The network communication system of claim 7 wherein at least some of the metering devices 

2 each comprises at least one of a network switch, a network hub, and a network router. 

1 15. A method of operation of a metering device, the method comprising: 

2 determining an identification of a network device sending or receiving a packet; 

3 if the identification of the network device is not already stored in a detected device list, 

4 adding the identification of the network device to the detected device list; and 

5 for each of at least one packet characteristic of the packet, 
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6 reading a weight definition of that packet characteristic from a weight definition store, 

7 calculating a weight for the packet, and 

8 updating a packet weight history. 

1 16. The method of claim 1 5 wherein each of the at least one packet characteristic comprises one 

2 of: 

3 communication protocol; 

4 packet size; 

5 time that the packet was sent; 

6 time that the packet was received; 

7 current average network throughput; 

8 current peak network throughput; 
|f; total amount of data transferred; 

IB total amount of data transferred since some particular time; 

I g total amount of data transferred since some particular event; 

|g number of packets transferred that are in a given size range; 

ill 1 , 

4|| traffic to particular addresses or ports or networks or sub-nets or network devices; 

p :; traffic from particular addresses or ports or networks or sub-nets or network devices; 

jU average percentage of network utilization; 

M p eak percentage of network utilization; 

|i average number of TCP sessions open; 

18 peak number of TCP sessions open; 

19 average traffic level of a particular protocol; 

20 average traffic level of a particular protocol; and 

2 1 percentage mixes of specified protocols among the current network traffic. 

1 17. The method of claim 1 6 further comprising: 

2 redefining the weight definition in the weight definition store, of at least one packet 

3 characteristic. 

1 18. A method of metering communication network traffic, the method comprising, at each of M 

2 metering devices variously coupled to respective ones of N network devices: 
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3 receiving packets from network devices; 

4 analyzing packet headers of the packets; and 

5 in response to the analyzing, updating a weighted packet history; wherein 

6 N>4, M>2, and M:N is in the range of 1 :4 to 1 : 128. 

1 19. The method of claim 1 8 further comprising: 

2 rolling up metering reports from the M metering devices to at least one central server. 

1 20. The method of claim 1 9 further comprising: 

2 for each of at least one packet characteristic identified in the analyzing for a packet, 

3 determining a weight definition for that packet characteristic, 

4 calculating a weight for the packet, and 

,5 s using the calculated weight in the updating of the weighted packet history. 

h 

Cp 21. The method of claim 20 wherein each of the at least one packet characteristic comprises a 

til 

i respective one of 

*fS communication protocol; 

W packet size; 

|#: time that the packet was sent; 

ill 

.jtig time that the packet was received; 

current average network throughput; 

{# current peak network throughput; 

9 total amount of data transferred; 

10 total amount of data transferred since some particular time; 

1 1 total amount of data transferred since some particular event; 

12 number of packets transferred that are in a given size range; 

13 traffic to particular addresses or ports or networks or sub-nets or network devices; 

14 traffic from particular addresses or ports or networks or sub-nets or network devices; 

1 5 average percentage of network utilization; 

1 6 peak percentage of network utilization; 

17 average number of TCP sessions open; 

1 8 peak number of TCP sessions open; 
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19 average traffic level of a particular protocol; 

20 average traffic level of a particular protocol; and 

2 1 percentage mixes of specified protocols among the current network traffic. 

1 22. The method of claim 20 further comprising: 

2 altering the weight definition in the weight definition store, of at least one packet 

3 characteristic. 

1 23 . An article of manufacture comprising: 

2 a machine-accessible medium including data that, when accessed by a machine, cause the 

3 machine to, 

4 analyze a packet header of a packet, 

4 identify a first network device which sent the packet, 

gl identify a second network device to which the packet was sent, 

Ill if the first or second network device is not already identified in a detected device list, 

% adding the first or second network device to the detected device list, 

i| for each of at least one packet characteristic of the packet, 

10 calculating a weight for the packet, and 

J updating a packet weight history for that packet characteristic of that packet in 

|| a packet weight history store. 

O 

5 24. The article of manufacture of claim 23 wherein the machine-accessible medium further 

2 includes data that cause the machine to: 

3 reset at least some content of the packet weight history store. 
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